projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 739e1c91 GKH |
1 | From 691c9ae099b9bcb5c27125af00a4a90120977458 Mon Sep 17 00:00:00 2001 |
| 2 | From: Francesco Lavra <francescolavra@interfree.it> | |
| 3 | Date: Sun, 7 Feb 2010 09:49:58 -0300 | |
| 4 | Subject: V4L/DVB: dvb-core: fix initialization of feeds list in demux filter | |
| 5 | ||
| 6 | From: Francesco Lavra <francescolavra@interfree.it> | |
| 7 | ||
| 8 | commit 691c9ae099b9bcb5c27125af00a4a90120977458 upstream. | |
| 9 | ||
| 10 | A DVB demultiplexer device can be used to set up either a PES filter or | |
| 11 | a section filter. In the former case, the ts field of the feed union of | |
| 12 | struct dmxdev_filter is used, in the latter case the sec field of the | |
| 13 | same union is used. | |
| 14 | The ts field is a struct list_head, and is currently initialized in the | |
| 15 | open() method of the demux device. When for a given demuxer a section | |
| 16 | filter is set up, the sec field is played with, thus if a PES filter | |
| 17 | needs to be set up after that the ts field will be corrupted, causing a | |
| 18 | kernel oops. | |
| 19 | This fix moves the list head initialization to | |
| 20 | dvb_dmxdev_pes_filter_set(), so that the ts field is properly | |
| 21 | initialized every time a PES filter is set up. | |
| 22 | ||
| 23 | Signed-off-by: Francesco Lavra <francescolavra@interfree.it> | |
| 24 | Reviewed-by: Andy Walls <awalls@radix.net> | |
| 25 | Tested-by: hermann pitton <hermann-pitton@arcor.de> | |
| 26 | Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> | |
| 27 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
| 28 | ||
| 29 | --- | |
| 30 | drivers/media/dvb/dvb-core/dmxdev.c | 2 +- | |
| 31 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
| 32 | ||
| 33 | --- a/drivers/media/dvb/dvb-core/dmxdev.c | |
| 34 | +++ b/drivers/media/dvb/dvb-core/dmxdev.c | |
| 35 | @@ -761,7 +761,6 @@ static int dvb_demux_open(struct inode * | |
| 36 | dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192); | |
| 37 | dmxdevfilter->type = DMXDEV_TYPE_NONE; | |
| 38 | dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED); | |
| 39 | - INIT_LIST_HEAD(&dmxdevfilter->feed.ts); | |
| 40 | init_timer(&dmxdevfilter->timer); | |
| 41 | ||
| 42 | dvbdev->users++; | |
| 43 | @@ -887,6 +886,7 @@ static int dvb_dmxdev_pes_filter_set(str | |
| 44 | dmxdevfilter->type = DMXDEV_TYPE_PES; | |
| 45 | memcpy(&dmxdevfilter->params, params, | |
| 46 | sizeof(struct dmx_pes_filter_params)); | |
| 47 | + INIT_LIST_HEAD(&dmxdevfilter->feed.ts); | |
| 48 | ||
| 49 | dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET); | |
| 50 |